Seeking Recommendations for Tinymath Alternatives in Opensearch

OpenSearch Dashboards
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):

Describe the issue:

Hello Opensearch Contributors,

I hope this message finds you well. I am currently working on a project that utilizes the Tinymath library for mathematical operations in JavaScript. However, I recently discovered that Tinymath has been abandoned for the past four years and contributes to CSP-related vulnerabilities in Opensearch.

As a result, I am exploring alternative libraries that are actively maintained and do not introduce any security issues. After conducting some research, I have narrowed down the list to the following options:

  1. BigNumber.js (GitHub - MikeMcl/bignumber.js: A JavaScript library for arbitrary-precision decimal and non-decimal arithmetic)
  2. Decimal.js (GitHub - MikeMcl/decimal.js: An arbitrary-precision Decimal type for JavaScript)
  3. Math.js (https://mathjs.org/)
  4. Numeral.js (http://numeraljs.com/)

Each library appears to be lightweight and offers different features, but I would like to seek the community’s input on which option might be the most suitable for use in Opensearch.

Please share your thoughts, experiences, and any recommendations you might have regarding these libraries or other potential alternatives. Your valuable insights will help me make an informed decision and contribute to enhancing the security and performance of Opensearch…

2

I am in favor of switching especially if its unmaintained. I think my biggest concern would be do we know if we have the mechanisms to ensure that the replacement is accurate relative to the previous. Math can be tricky when it comes to ways floats are managed.

3

@ltwmori What good timing! @AbbyHu was just working on the issues for replacing Tinymath yesterday: [Tech Debt] Remove dependency on 'TinyMath' · Issue #3655 · opensearch-project/OpenSearch-Dashboards · GitHub

Would you mind posting your findings to the research task: https://github.com/opensearfch-project/OpenSearch-Dashboards/issues/3656 ?

So far, we’re leaning toward Math.js, based on preliminary research. And, although OpenSearch Dashboards already uses Numeral.js for number formatting, it has been abandoned and contains several bugs (replacement candidates for our needs include numbro and d3-format). So we probably can cross that option off the list.

2 Likes